1. Technical Field
This application relates to the field of data security and validation, and more particularly to the field of verifying and validating digital certificates and other information.
2. Description of Related Art
It is useful to be able to determine the status of a digital certificate, including determining whether the certificate was validly issued and/or whether the certificate has been revoked prior to the expiration thereof. There are a number of techniques for determining the status of an individual digital certificate. For example, U.S. Pat. Nos. 5,666,416 and 5,717,758 describe techniques for providing individual certificate status. Other techniques for disseminating and ascertaining certificate status are also known, including Certificate Revocation Lists (CRL's), which are digitally-signed list of revoked certificates.
Verifying a digital certificate may require having to trust the issuer of the digital certificate and/or trust the signer of the revocation information, which may or may not be the same entity. In the case of a digital certificate, “trusting” an issuer and/or a signer of revocation information may refer to the fact that the issuer and/or signer is a known authority having a valid public key corresponding to a secret key that was used to sign the certificate and/or the revocation information. For example, a user may receive a digital certificate that is digitally signed by an authority, A, and may also receive an up-to-date CRL (that does not contain the digital certificate) signed by a different authority, A′. However, the user would want to be able to trust both A and A′ along with their public keys (corresponding to the secret keys used to sign the certificate and the CRL) in order to be able to honor the certificate.
There are mechanisms for facilitating dissemination and trust of otherwise unknown authorities that issue certificates and revocation information. In some instances, it is possible to have a trusted authority digitally sign information (or otherwise validate the information) to verify an otherwise unknown authority. Thereafter, the previously-unknown authority may present digitally-signed information (e.g., a digital certificate and/or revocation information) that may be verified using the public key of the previously-unknown authority. For example, if a user does not know or trust the digital signature of authorities A1 and A2, but the user does know and trust authority A3, then the user may obtain (or be presented with) information digitally signed by A3 (and thus vouched for by A3) indicating that A1 and A2 are trustworthy authorities. Thus, if such a user were presented with a digital certificate signed by A1 and a CRL (that does not list the digital certificate) signed by A2, the user would use the information vouched for by A3 to verify the validity of the presented certificate.
There are also nesting mechanisms that may be used in instances where authorities vouch for other authorities. For example, U.S. Pat. No. 5,717,759, which is incorporated by reference herein, discloses a technique where a first authority, A1, vouches for a second authority, A2, who vouches for a third authority, A3, etc. until the nesting reaches an authority trusted by a potential user. In some instances, vouching may include providing a digital signature of the vouching authority.
Although nesting and other mechanisms are useful, in some cases a user may be presented with a digital certificate and/or revocation information and/or some other information for which there is no straight-forward mechanism for determining whether the signer of the certificate/revocation information/other information may be trusted and thus the user may not be able to determine whether the digital certificate is currently valid. Accordingly, it would be useful to address this.